@adminforth/bulk-ai-flow 1.27.2 → 1.27.4

package/build.log

@@ -14,5 +14,5 @@ custom/package.json
 custom/pnpm-lock.yaml
 custom/tsconfig.json
 
-sent 130,454 bytes  received 191 bytes  261,290.00 bytes/sec
+sent 130,464 bytes  received 191 bytes  261,310.00 bytes/sec
 total size is 129,741  speedup is 0.99

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 import { AdminForthPlugin } from "adminforth";
-import type { IAdminForth, IHttpServer, AdminForthResource } from "adminforth";
+import type { IAdminForth, IHttpServer, AdminForthResource, AdminUser } from "adminforth";
 import type { PluginOptions } from './types.js';
 import { RateLimiter } from "adminforth";
 export default class BulkAiFlowPlugin extends AdminForthPlugin {
@@ -26,5 +26,13 @@ export default class BulkAiFlowPlugin extends AdminForthPlugin {
     modifyResourceConfig(adminforth: IAdminForth, resourceConfig: AdminForthResource): Promise<void>;
     validateConfigAfterDiscover(adminforth: IAdminForth, resourceConfig: AdminForthResource): void;
     instanceUniqueRepresentation(pluginOptions: any): string;
+    pluginManagedFields(): Set<string>;
+    checkUpdateAllowed({ adminUser, requestBody, recordId, oldRecord, fields }: {
+        adminUser: AdminUser;
+        requestBody: any;
+        recordId: any;
+        oldRecord: any;
+        fields: Record<string, any>;
+    }): Promise<string | null>;
     setupEndpoints(server: IHttpServer): void;
 }

package/dist/index.js

@@ -7,7 +7,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         step((generator = generator.apply(thisArg, _arguments || [])).next());
     });
 };
-import { AdminForthFilterOperators, AdminForthPlugin, Filters } from "adminforth";
+import { AdminForthFilterOperators, AdminForthPlugin, Filters, interpretResource, ActionCheckSource, AllowedActionsEnum } from "adminforth";
 import { suggestIfTypo, filtersTools } from "adminforth";
 import Handlebars from 'handlebars';
 import { RateLimiter } from "adminforth";
@@ -55,6 +55,43 @@ const compileOldImageLinkBodySchema = z.object({
 const getFilteredIdsBodySchema = z.object({
     filters: z.any(),
 }).passthrough();
+function resolveBoolOrFn(val, ctx) {
+    return __awaiter(this, void 0, void 0, function* () {
+        if (typeof val === 'function') {
+            return !!(yield val(ctx));
+        }
+        return !!val;
+    });
+}
+function isShownInEdit(column, ctx) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const showIn = column.showIn || {};
+        if (showIn.edit !== undefined) {
+            return yield resolveBoolOrFn(showIn.edit, ctx);
+        }
+        if (showIn.all !== undefined) {
+            return yield resolveBoolOrFn(showIn.all, ctx);
+        }
+        return true;
+    });
+}
+function valueIsUnchanged(newValue, oldValue) {
+    if (newValue === oldValue) {
+        return true;
+    }
+    if (newValue === null || newValue === undefined || oldValue === null || oldValue === undefined) {
+        return false;
+    }
+    if (typeof newValue === 'object' || typeof oldValue === 'object') {
+        try {
+            return JSON.stringify(newValue) === JSON.stringify(oldValue);
+        }
+        catch (_a) {
+            return false;
+        }
+    }
+    return String(newValue) === String(oldValue);
+}
 const STUB_MODE = false;
 const jobs = new Map();
 export default class BulkAiFlowPlugin extends AdminForthPlugin {
@@ -810,6 +847,66 @@ export default class BulkAiFlowPlugin extends AdminForthPlugin {
     instanceUniqueRepresentation(pluginOptions) {
         return `${this.pluginOptions.actionName}`;
     }
+    pluginManagedFields() {
+        return new Set([
+            ...Object.keys(this.options.fillFieldsFromImages || {}),
+            ...Object.keys(this.options.fillPlainFields || {}),
+            ...Object.keys(this.options.generateImages || {}),
+        ]);
+    }
+    checkUpdateAllowed(_a) {
+        return __awaiter(this, arguments, void 0, function* ({ adminUser, requestBody, recordId, oldRecord, fields }) {
+            const meta = { requestBody, newRecord: fields, oldRecord, pk: recordId };
+            const ctx = {
+                adminUser,
+                resource: this.resourceConfig,
+                meta,
+                source: ActionCheckSource.EditRequest,
+                adminforth: this.adminforth,
+            };
+            const { allowedActions } = yield interpretResource(adminUser, this.resourceConfig, meta, ActionCheckSource.EditRequest, this.adminforth);
+            const editAllowed = allowedActions[AllowedActionsEnum.edit];
+            if (editAllowed !== true) {
+                return typeof editAllowed === 'string' ? editAllowed : 'You are not allowed to edit records in this resource';
+            }
+            const managedFields = this.pluginManagedFields();
+            for (const [fieldName, value] of Object.entries(fields)) {
+                if (valueIsUnchanged(value, oldRecord[fieldName])) {
+                    continue;
+                }
+                const column = this.resourceConfig.columns.find((col) => col.name === fieldName);
+                if (!column) {
+                    return `Field "${fieldName}" does not exist in resource "${this.resourceConfig.resourceId}"`;
+                }
+                if (!managedFields.has(fieldName)) {
+                    return `Field "${fieldName}" cannot be modified, it is not generated by the "${this.options.actionName}" action`;
+                }
+                if (column.primaryKey) {
+                    return `Field "${fieldName}" cannot be modified as it is a primary key`;
+                }
+                if (yield resolveBoolOrFn(column.backendOnly, ctx)) {
+                    return `Field "${fieldName}" cannot be modified as it is restricted from editing (backendOnly is true).`;
+                }
+                if (column.editReadonly) {
+                    return `Field "${fieldName}" cannot be modified as it is restricted from editing (editReadonly is true).`;
+                }
+                if (!(yield isShownInEdit(column, ctx)) && !column.allowModifyWhenNotShowInEdit) {
+                    return `Field "${fieldName}" cannot be modified as it is restricted from editing (showIn.edit is false). If you need to allow updating this hidden field, set column.allowModifyWhenNotShowInEdit = true.`;
+                }
+            }
+            if (this.options.isAllowedToSave) {
+                const isAllowedToSave = yield this.options.isAllowedToSave({
+                    record: oldRecord,
+                    adminUser: adminUser,
+                    resource: this.resourceConfig,
+                });
+                if ((isAllowedToSave === null || isAllowedToSave === void 0 ? void 0 : isAllowedToSave.ok) === false) {
+                    return isAllowedToSave.error;
+                }
+            }
+            return null;
+        });
+    }
     setupEndpoints(server) {
         server.endpoint({
             method: 'POST',
@@ -856,101 +953,121 @@ export default class BulkAiFlowPlugin extends AdminForthPlugin {
             request_schema: updateFieldsBodySchema,
             handler: (_a) => __awaiter(this, [_a], void 0, function* ({ body, adminUser, headers, response }) {
                 const data = body;
-                let isAllowedToSave = { ok: true, error: '' };
-                if (this.options.isAllowedToSave) {
-                    isAllowedToSave = yield this.options.isAllowedToSave({ record: {}, adminUser: adminUser, resource: this.resourceConfig });
-                }
-                if (isAllowedToSave.ok !== false) {
-                    const selectedIds = data.selectedIds || [];
-                    const fieldsToUpdate = data.fields || {};
-                    const saveImages = data.saveImages;
-                    const outputImageFields = [];
-                    if (this.options.generateImages) {
-                        for (const [key, value] of Object.entries(this.options.generateImages)) {
-                            outputImageFields.push(key);
-                        }
+                const selectedIds = data.selectedIds || [];
+                const fieldsToUpdate = data.fields || {};
+                const saveImages = data.saveImages;
+                const outputImageFields = [];
+                if (this.options.generateImages) {
+                    for (const [key, value] of Object.entries(this.options.generateImages)) {
+                        outputImageFields.push(key);
                     }
-                    const primaryKeyColumn = this.resourceConfig.columns.find((col) => col.primaryKey);
-                    const decimalFieldsArray = this.resourceConfig.columns.filter(c => c.type === 'decimal').map(c => c.name);
-                    const integerFieldsArray = this.resourceConfig.columns.filter(c => c.type === 'integer').map(c => c.name);
-                    const floatFieldsArray = this.resourceConfig.columns.filter(c => c.type === 'float').map(c => c.name);
-                    const updates = selectedIds.map((ID, idx) => __awaiter(this, void 0, void 0, function* () {
-                        const oldRecord = yield this.adminforth.resource(this.resourceConfig.resourceId).get([Filters.EQ(primaryKeyColumn.name, ID)]);
-                        for (const [key, value] of Object.entries(outputImageFields)) {
-                            const columnPlugin = this.adminforth.activatedPlugins.find(p => p.resourceConfig.resourceId === this.resourceConfig.resourceId &&
-                                p.pluginOptions.pathColumnName === value);
-                            if (columnPlugin && saveImages) {
-                                if (columnPlugin.pluginOptions.storageAdapter.objectCanBeAccesedPublicly()) {
-                                    if (oldRecord[value]) {
-                                        // put tag to delete old file
-                                        try {
-                                            if (columnPlugin.pluginOptions.storageAdapter.markKeyForDeletion !== undefined) {
-                                                yield columnPlugin.pluginOptions.storageAdapter.markKeyForDeletion(oldRecord[value]);
-                                            }
-                                            else {
-                                                yield columnPlugin.pluginOptions.storageAdapter.markKeyForDeletation(oldRecord[value]);
-                                            }
-                                        }
-                                        catch (e) {
-                                            // file might be e.g. already deleted, so we catch error
-                                            console.error(`Error setting tag to true for object ${oldRecord[value]}. File will not be auto-cleaned up`);
-                                        }
-                                    }
-                                    if (fieldsToUpdate[idx][value] && fieldsToUpdate[idx][value] !== null) {
-                                        // remove tag from new file
-                                        // in this case we let it crash if it fails: this is a new file which just was uploaded. 
-                                        if (columnPlugin.pluginOptions.storageAdapter.markKeyForNotDeletion !== undefined) {
-                                            yield columnPlugin.pluginOptions.storageAdapter.markKeyForNotDeletion(fieldsToUpdate[idx][value]);
+                }
+                const primaryKeyColumn = this.resourceConfig.columns.find((col) => col.primaryKey);
+                const decimalFieldsArray = this.resourceConfig.columns.filter(c => c.type === 'decimal').map(c => c.name);
+                const integerFieldsArray = this.resourceConfig.columns.filter(c => c.type === 'integer').map(c => c.name);
+                const floatFieldsArray = this.resourceConfig.columns.filter(c => c.type === 'float').map(c => c.name);
+                // authorize every record before touching anything: this endpoint writes to the same
+                // table as the core edit route, so it has to enforce the same permissions
+                const managedFields = this.pluginManagedFields();
+                const oldRecords = [];
+                const sanitizedFields = [];
+                for (const [idx, ID] of selectedIds.entries()) {
+                    const oldRecord = yield this.adminforth.resource(this.resourceConfig.resourceId).get([Filters.EQ(primaryKeyColumn.name, ID)]);
+                    if (!oldRecord) {
+                        return { ok: false, error: `Record with ${primaryKeyColumn.name} ${ID} not found` };
+                    }
+                    const fields = fieldsToUpdate[idx];
+                    if (!fields || typeof fields !== 'object' || Array.isArray(fields)) {
+                        return { ok: false, error: `No fields to update passed for record ${ID}` };
+                    }
+                    const accessError = yield this.checkUpdateAllowed({
+                        adminUser,
+                        requestBody: body,
+                        recordId: ID,
+                        oldRecord,
+                        fields,
+                    });
+                    if (accessError) {
+                        return { ok: false, error: accessError };
+                    }
+                    oldRecords.push(oldRecord);
+                    // everything else (e.g. the primary key which frontend echoes back) is never written
+                    sanitizedFields.push(Object.fromEntries(Object.entries(fields).filter(([fieldName]) => managedFields.has(fieldName))));
+                }
+                const updates = selectedIds.map((ID, idx) => __awaiter(this, void 0, void 0, function* () {
+                    const oldRecord = oldRecords[idx];
+                    const recordFields = sanitizedFields[idx];
+                    for (const [key, value] of Object.entries(outputImageFields)) {
+                        const columnPlugin = this.adminforth.activatedPlugins.find(p => p.resourceConfig.resourceId === this.resourceConfig.resourceId &&
+                            p.pluginOptions.pathColumnName === value);
+                        if (columnPlugin && saveImages) {
+                            if (columnPlugin.pluginOptions.storageAdapter.objectCanBeAccesedPublicly()) {
+                                if (oldRecord[value]) {
+                                    // put tag to delete old file
+                                    try {
+                                        if (columnPlugin.pluginOptions.storageAdapter.markKeyForDeletion !== undefined) {
+                                            yield columnPlugin.pluginOptions.storageAdapter.markKeyForDeletion(oldRecord[value]);
                                         }
                                         else {
-                                            yield columnPlugin.pluginOptions.storageAdapter.markKeyForNotDeletation(fieldsToUpdate[idx][value]);
+                                            yield columnPlugin.pluginOptions.storageAdapter.markKeyForDeletation(oldRecord[value]);
                                         }
                                     }
+                                    catch (e) {
+                                        // file might be e.g. already deleted, so we catch error
+                                        console.error(`Error setting tag to true for object ${oldRecord[value]}. File will not be auto-cleaned up`);
+                                    }
                                 }
-                            }
-                        }
-                        // Convert decimal fields to numbers
-                        if (decimalFieldsArray.length > 0) {
-                            for (const fieldName of decimalFieldsArray) {
-                                if (fieldsToUpdate[idx].hasOwnProperty(fieldName)) {
-                                    fieldsToUpdate[idx][fieldName] = `${fieldsToUpdate[idx][fieldName]}`;
+                                if (recordFields[value] && recordFields[value] !== null) {
+                                    // remove tag from new file
+                                    // in this case we let it crash if it fails: this is a new file which just was uploaded. 
+                                    if (columnPlugin.pluginOptions.storageAdapter.markKeyForNotDeletion !== undefined) {
+                                        yield columnPlugin.pluginOptions.storageAdapter.markKeyForNotDeletion(recordFields[value]);
+                                    }
+                                    else {
+                                        yield columnPlugin.pluginOptions.storageAdapter.markKeyForNotDeletation(recordFields[value]);
+                                    }
                                 }
                             }
                         }
-                        if (integerFieldsArray.length > 0) {
-                            for (const fieldName of integerFieldsArray) {
-                                if (fieldsToUpdate[idx].hasOwnProperty(fieldName)) {
-                                    fieldsToUpdate[idx][fieldName] = parseInt(fieldsToUpdate[idx][fieldName], 10);
-                                }
+                    }
+                    // Convert decimal fields to numbers
+                    if (decimalFieldsArray.length > 0) {
+                        for (const fieldName of decimalFieldsArray) {
+                            if (recordFields.hasOwnProperty(fieldName)) {
+                                recordFields[fieldName] = `${recordFields[fieldName]}`;
                             }
                         }
-                        if (floatFieldsArray.length > 0) {
-                            for (const fieldName of floatFieldsArray) {
-                                if (fieldsToUpdate[idx].hasOwnProperty(fieldName)) {
-                                    fieldsToUpdate[idx][fieldName] = parseFloat(fieldsToUpdate[idx][fieldName]);
-                                }
+                    }
+                    if (integerFieldsArray.length > 0) {
+                        for (const fieldName of integerFieldsArray) {
+                            if (recordFields.hasOwnProperty(fieldName)) {
+                                recordFields[fieldName] = parseInt(recordFields[fieldName], 10);
                             }
                         }
-                        const newRecord = Object.assign(Object.assign({}, oldRecord), fieldsToUpdate[idx]);
-                        return this.adminforth.updateResourceRecord({
-                            resource: this.resourceConfig,
-                            recordId: ID,
-                            oldRecord: oldRecord,
-                            updates: newRecord,
-                            adminUser: adminUser,
-                        });
-                    }));
-                    try {
-                        yield Promise.all(updates);
                     }
-                    catch (error) {
-                        return { ok: false, error: `Error updating records, because of unprocesseble data for record ID ${selectedIds}` };
+                    if (floatFieldsArray.length > 0) {
+                        for (const fieldName of floatFieldsArray) {
+                            if (recordFields.hasOwnProperty(fieldName)) {
+                                recordFields[fieldName] = parseFloat(recordFields[fieldName]);
+                            }
+                        }
                     }
-                    return { ok: true };
+                    const newRecord = Object.assign(Object.assign({}, oldRecord), recordFields);
+                    return this.adminforth.updateResourceRecord({
+                        resource: this.resourceConfig,
+                        recordId: ID,
+                        oldRecord: oldRecord,
+                        updates: newRecord,
+                        adminUser: adminUser,
+                    });
+                }));
+                try {
+                    yield Promise.all(updates);
                 }
-                else {
-                    return { ok: false, error: isAllowedToSave.error };
+                catch (error) {
+                    return { ok: false, error: `Error updating records, because of unprocesseble data for record ID ${selectedIds}` };
                 }
+                return { ok: true };
             })
         });
         server.endpoint({

package/index.ts

@@ -1,5 +1,5 @@
-import { AdminForthFilterOperators, AdminForthPlugin, Filters } from "adminforth";
-import type { IAdminForth, IHttpServer, AdminForthComponentDeclaration, AdminForthResource } from "adminforth";
+import { AdminForthFilterOperators, AdminForthPlugin, Filters, interpretResource, ActionCheckSource, AllowedActionsEnum } from "adminforth";
+import type { IAdminForth, IHttpServer, AdminForthComponentDeclaration, AdminForthResource, AdminUser } from "adminforth";
 import { suggestIfTypo, filtersTools } from "adminforth";
 import type { PluginOptions } from './types.js';
 import Handlebars from 'handlebars';
@@ -58,6 +58,49 @@ const compileOldImageLinkBodySchema = z.object({
 const getFilteredIdsBodySchema = z.object({
   filters: z.any(),
 }).passthrough();
+
+type AccessCheckContext = {
+  adminUser: AdminUser;
+  resource: AdminForthResource;
+  meta: any;
+  source: ActionCheckSource;
+  adminforth: IAdminForth;
+};
+
+async function resolveBoolOrFn(val: any, ctx: AccessCheckContext): Promise<boolean> {
+  if (typeof val === 'function') {
+    return !!(await val(ctx));
+  }
+  return !!val;
+}
+
+async function isShownInEdit(column: AdminForthResource['columns'][number], ctx: AccessCheckContext): Promise<boolean> {
+  const showIn = (column.showIn as any) || {};
+  if (showIn.edit !== undefined) {
+    return await resolveBoolOrFn(showIn.edit, ctx);
+  }
+  if (showIn.all !== undefined) {
+    return await resolveBoolOrFn(showIn.all, ctx);
+  }
+  return true;
+}
+
+function valueIsUnchanged(newValue: any, oldValue: any): boolean {
+  if (newValue === oldValue) {
+    return true;
+  }
+  if (newValue === null || newValue === undefined || oldValue === null || oldValue === undefined) {
+    return false;
+  }
+  if (typeof newValue === 'object' || typeof oldValue === 'object') {
+    try {
+      return JSON.stringify(newValue) === JSON.stringify(oldValue);
+    } catch {
+      return false;
+    }
+  }
+  return String(newValue) === String(oldValue);
+}
 const STUB_MODE = false;
 const jobs = new Map(); 
 export default class  BulkAiFlowPlugin extends AdminForthPlugin {
@@ -828,6 +871,84 @@ export default class  BulkAiFlowPlugin extends AdminForthPlugin {
     return `${this.pluginOptions.actionName}`;
   }
 
+  pluginManagedFields(): Set<string> {
+    return new Set([
+      ...Object.keys(this.options.fillFieldsFromImages || {}),
+      ...Object.keys(this.options.fillPlainFields || {}),
+      ...Object.keys(this.options.generateImages || {}),
+    ]);
+  }
+
+
+  async checkUpdateAllowed({ adminUser, requestBody, recordId, oldRecord, fields }: {
+    adminUser: AdminUser,
+    requestBody: any,
+    recordId: any,
+    oldRecord: any,
+    fields: Record<string, any>,
+  }): Promise<string | null> {
+    const meta = { requestBody, newRecord: fields, oldRecord, pk: recordId };
+    const ctx: AccessCheckContext = {
+      adminUser,
+      resource: this.resourceConfig,
+      meta,
+      source: ActionCheckSource.EditRequest,
+      adminforth: this.adminforth,
+    };
+
+    const { allowedActions } = await interpretResource(
+      adminUser,
+      this.resourceConfig,
+      meta,
+      ActionCheckSource.EditRequest,
+      this.adminforth,
+    );
+    const editAllowed = allowedActions[AllowedActionsEnum.edit] as boolean | string | undefined;
+    if (editAllowed !== true) {
+      return typeof editAllowed === 'string' ? editAllowed : 'You are not allowed to edit records in this resource';
+    }
+
+    const managedFields = this.pluginManagedFields();
+
+    for (const [fieldName, value] of Object.entries(fields)) {
+      if (valueIsUnchanged(value, oldRecord[fieldName])) {
+        continue;
+      }
+      const column = this.resourceConfig.columns.find((col) => col.name === fieldName);
+      if (!column) {
+        return `Field "${fieldName}" does not exist in resource "${this.resourceConfig.resourceId}"`;
+      }
+      if (!managedFields.has(fieldName)) {
+        return `Field "${fieldName}" cannot be modified, it is not generated by the "${this.options.actionName}" action`;
+      }
+      if (column.primaryKey) {
+        return `Field "${fieldName}" cannot be modified as it is a primary key`;
+      }
+      if (await resolveBoolOrFn(column.backendOnly, ctx)) {
+        return `Field "${fieldName}" cannot be modified as it is restricted from editing (backendOnly is true).`;
+      }
+      if (column.editReadonly) {
+        return `Field "${fieldName}" cannot be modified as it is restricted from editing (editReadonly is true).`;
+      }
+      if (!(await isShownInEdit(column, ctx)) && !column.allowModifyWhenNotShowInEdit) {
+        return `Field "${fieldName}" cannot be modified as it is restricted from editing (showIn.edit is false). If you need to allow updating this hidden field, set column.allowModifyWhenNotShowInEdit = true.`;
+      }
+    }
+
+    if (this.options.isAllowedToSave) {
+      const isAllowedToSave = await this.options.isAllowedToSave({
+        record: oldRecord,
+        adminUser: adminUser,
+        resource: this.resourceConfig,
+      });
+      if (isAllowedToSave?.ok === false) {
+        return isAllowedToSave.error;
+      }
+    }
+
+    return null;
+  }
+
   setupEndpoints(server: IHttpServer) {
     server.endpoint({
       method: 'POST',
@@ -878,105 +999,129 @@ export default class  BulkAiFlowPlugin extends AdminForthPlugin {
       request_schema: updateFieldsBodySchema,
       handler: async ({ body, adminUser, headers, response }) => {
         const data = body as z.infer<typeof updateFieldsBodySchema>;
-        let isAllowedToSave: any = { ok: true, error: '' };
-        if(this.options.isAllowedToSave) {
-          isAllowedToSave = await this.options.isAllowedToSave({ record: {}, adminUser: adminUser, resource: this.resourceConfig });
+        const selectedIds = data.selectedIds || [];
+        const fieldsToUpdate = data.fields || {};
+        const saveImages = data.saveImages;
+        const outputImageFields = [];
+        if (this.options.generateImages) {
+          for (const [key, value] of Object.entries(this.options.generateImages)) {
+            outputImageFields.push(key);
+          }
         }
-        if (isAllowedToSave.ok !== false) {
-          const selectedIds = data.selectedIds || [];
-          const fieldsToUpdate = data.fields || {};
-          const saveImages = data.saveImages;
-          const outputImageFields = [];
-          if (this.options.generateImages) {
-            for (const [key, value] of Object.entries(this.options.generateImages)) {
-              outputImageFields.push(key);
-            }
+        const primaryKeyColumn = this.resourceConfig.columns.find((col) => col.primaryKey);
+
+        const decimalFieldsArray = this.resourceConfig.columns.filter(c => c.type === 'decimal').map(c => c.name);
+        const integerFieldsArray = this.resourceConfig.columns.filter(c => c.type === 'integer').map(c => c.name);
+        const floatFieldsArray = this.resourceConfig.columns.filter(c => c.type === 'float').map(c => c.name);
+
+        // authorize every record before touching anything: this endpoint writes to the same
+        // table as the core edit route, so it has to enforce the same permissions
+        const managedFields = this.pluginManagedFields();
+        const oldRecords: any[] = [];
+        const sanitizedFields: Record<string, any>[] = [];
+        for (const [idx, ID] of selectedIds.entries()) {
+          const oldRecord = await this.adminforth.resource(this.resourceConfig.resourceId).get( [Filters.EQ(primaryKeyColumn.name, ID)] );
+          if (!oldRecord) {
+            return { ok: false, error: `Record with ${primaryKeyColumn.name} ${ID} not found` };
           }
-          const primaryKeyColumn = this.resourceConfig.columns.find((col) => col.primaryKey);
-
-          const decimalFieldsArray = this.resourceConfig.columns.filter(c => c.type === 'decimal').map(c => c.name);
-          const integerFieldsArray = this.resourceConfig.columns.filter(c => c.type === 'integer').map(c => c.name);
-          const floatFieldsArray = this.resourceConfig.columns.filter(c => c.type === 'float').map(c => c.name);
-
-          const updates = selectedIds.map(async (ID, idx) => {
-            const oldRecord = await this.adminforth.resource(this.resourceConfig.resourceId).get( [Filters.EQ(primaryKeyColumn.name, ID)] );
-            for (const [key, value] of Object.entries(outputImageFields)) {
-              const columnPlugin = this.adminforth.activatedPlugins.find(p => 
-                p.resourceConfig!.resourceId === this.resourceConfig.resourceId &&
-                p.pluginOptions.pathColumnName === value
-              );
-              if (columnPlugin && saveImages) {
-                if(columnPlugin.pluginOptions.storageAdapter.objectCanBeAccesedPublicly()) {
-                  if (oldRecord[value]) {
-                    // put tag to delete old file
-                    try {
-                      if (columnPlugin.pluginOptions.storageAdapter.markKeyForDeletion !== undefined) {
-                        await columnPlugin.pluginOptions.storageAdapter.markKeyForDeletion(oldRecord[value]);
-                      } else {
-                        await columnPlugin.pluginOptions.storageAdapter.markKeyForDeletation(oldRecord[value]);
-                      }
-                    } catch (e) {
-                      // file might be e.g. already deleted, so we catch error
-                      console.error(`Error setting tag to true for object ${oldRecord[value]}. File will not be auto-cleaned up`);
-                    }
-                  }
-                  if (fieldsToUpdate[idx][value] && fieldsToUpdate[idx][value] !== null) {
-                  // remove tag from new file
-                  // in this case we let it crash if it fails: this is a new file which just was uploaded. 
-                    if (columnPlugin.pluginOptions.storageAdapter.markKeyForNotDeletion !== undefined) {
-                      await  columnPlugin.pluginOptions.storageAdapter.markKeyForNotDeletion(fieldsToUpdate[idx][value]);
+          const fields = fieldsToUpdate[idx];
+          if (!fields || typeof fields !== 'object' || Array.isArray(fields)) {
+            return { ok: false, error: `No fields to update passed for record ${ID}` };
+          }
+          const accessError = await this.checkUpdateAllowed({
+            adminUser,
+            requestBody: body,
+            recordId: ID,
+            oldRecord,
+            fields,
+          });
+          if (accessError) {
+            return { ok: false, error: accessError };
+          }
+          oldRecords.push(oldRecord);
+          // everything else (e.g. the primary key which frontend echoes back) is never written
+          sanitizedFields.push(Object.fromEntries(
+            Object.entries(fields).filter(([fieldName]) => managedFields.has(fieldName))
+          ));
+        }
+
+        const updates = selectedIds.map(async (ID, idx) => {
+          const oldRecord = oldRecords[idx];
+          const recordFields = sanitizedFields[idx];
+          for (const [key, value] of Object.entries(outputImageFields)) {
+            const columnPlugin = this.adminforth.activatedPlugins.find(p => 
+              p.resourceConfig!.resourceId === this.resourceConfig.resourceId &&
+              p.pluginOptions.pathColumnName === value
+            );
+            if (columnPlugin && saveImages) {
+              if(columnPlugin.pluginOptions.storageAdapter.objectCanBeAccesedPublicly()) {
+                if (oldRecord[value]) {
+                  // put tag to delete old file
+                  try {
+                    if (columnPlugin.pluginOptions.storageAdapter.markKeyForDeletion !== undefined) {
+                      await columnPlugin.pluginOptions.storageAdapter.markKeyForDeletion(oldRecord[value]);
                     } else {
-                      await  columnPlugin.pluginOptions.storageAdapter.markKeyForNotDeletation(fieldsToUpdate[idx][value]);
+                      await columnPlugin.pluginOptions.storageAdapter.markKeyForDeletation(oldRecord[value]);
                     }
+                  } catch (e) {
+                    // file might be e.g. already deleted, so we catch error
+                    console.error(`Error setting tag to true for object ${oldRecord[value]}. File will not be auto-cleaned up`);
+                  }
+                }
+                if (recordFields[value] && recordFields[value] !== null) {
+                // remove tag from new file
+                // in this case we let it crash if it fails: this is a new file which just was uploaded. 
+                  if (columnPlugin.pluginOptions.storageAdapter.markKeyForNotDeletion !== undefined) {
+                    await  columnPlugin.pluginOptions.storageAdapter.markKeyForNotDeletion(recordFields[value]);
+                  } else {
+                    await  columnPlugin.pluginOptions.storageAdapter.markKeyForNotDeletation(recordFields[value]);
                   }
                 }
               }
             }
+          }
 
-            // Convert decimal fields to numbers
-            if (decimalFieldsArray.length > 0) {
-              for (const fieldName of decimalFieldsArray) {
-                if (fieldsToUpdate[idx].hasOwnProperty(fieldName)) {
-                  fieldsToUpdate[idx][fieldName] = `${fieldsToUpdate[idx][fieldName]}`;
-                }
+          // Convert decimal fields to numbers
+          if (decimalFieldsArray.length > 0) {
+            for (const fieldName of decimalFieldsArray) {
+              if (recordFields.hasOwnProperty(fieldName)) {
+                recordFields[fieldName] = `${recordFields[fieldName]}`;
               }
             }
-            if (integerFieldsArray.length > 0) {
-              for (const fieldName of integerFieldsArray) {
-                if (fieldsToUpdate[idx].hasOwnProperty(fieldName)) {
-                  fieldsToUpdate[idx][fieldName] = parseInt(fieldsToUpdate[idx][fieldName], 10);
-                }
+          }
+          if (integerFieldsArray.length > 0) {
+            for (const fieldName of integerFieldsArray) {
+              if (recordFields.hasOwnProperty(fieldName)) {
+                recordFields[fieldName] = parseInt(recordFields[fieldName], 10);
               }
             }
-            if (floatFieldsArray.length > 0) {
-              for (const fieldName of floatFieldsArray) {
-                if (fieldsToUpdate[idx].hasOwnProperty(fieldName)) {
-                  fieldsToUpdate[idx][fieldName] = parseFloat(fieldsToUpdate[idx][fieldName]);
-                }
+          }
+          if (floatFieldsArray.length > 0) {
+            for (const fieldName of floatFieldsArray) {
+              if (recordFields.hasOwnProperty(fieldName)) {
+                recordFields[fieldName] = parseFloat(recordFields[fieldName]);
               }
             }
-
-            const newRecord = {
-              ...oldRecord,
-              ...fieldsToUpdate[idx]
-            };
-            return this.adminforth.updateResourceRecord({
-              resource: this.resourceConfig,
-              recordId: ID,
-              oldRecord: oldRecord,
-              updates: newRecord,
-              adminUser: adminUser,
-            })
-          });
-          try {
-            await Promise.all(updates);
-          } catch (error) {
-            return { ok: false, error: `Error updating records, because of unprocesseble data for record ID ${selectedIds}` };
           }
-          return { ok: true };
-        } else {
-          return { ok: false, error: isAllowedToSave.error };
+
+          const newRecord = {
+            ...oldRecord,
+            ...recordFields
+          };
+          return this.adminforth.updateResourceRecord({
+            resource: this.resourceConfig,
+            recordId: ID,
+            oldRecord: oldRecord,
+            updates: newRecord,
+            adminUser: adminUser,
+          })
+        });
+        try {
+          await Promise.all(updates);
+        } catch (error) {
+          return { ok: false, error: `Error updating records, because of unprocesseble data for record ID ${selectedIds}` };
         }
+        return { ok: true };
       }
     });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adminforth/bulk-ai-flow",
-  "version": "1.27.2",
+  "version": "1.27.4",
   "publishConfig": {
     "access": "public"
   },
@@ -8,6 +8,10 @@
   "types": "dist/index.d.ts",
   "type": "module",
   "homepage": "https://adminforth.dev/docs/tutorial/Plugins/bulk-ai-flow/",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/devforth/adminforth-bulk-ai-flow.git"
+  },
   "scripts": {
     "build": "tsc && rsync -av --exclude 'node_modules' custom dist/"
   },